Hi,
I have an issue with the evaluation license of my new FortiGate v7.4.1 VM, I am trying to license my new FortiGate and I am using my account credentials to connect to the forticare server but it fails, I did some troubleshooting and I notice that I can't ping the forticare.fortinet.com but instead the service.fortiguard.net and update.fortiguard.net were pinged successfully. can you please assist me with this problem.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
What is the error you are facing?
If you are failing to authenticate then it might be an issue with the user credentials.
-BR-
Created on 12-04-2023 03:16 PM Edited on 12-04-2023 03:21 PM
The error says "Error Communicating with FortiCare". the credentials are correct and the routing also is set and I can ping the google DNS but I still can't reach the FortiCare server.
Edit: in the console I got also the error "curl forticare failed, 28"
Hi,
Ensure that you dont have network access issue:
exec ping fds1.fortinet.com
exec ping directregistration.fortinet.com
exec ping globalftm.fortinet.net
execute ping directregistration.fortinet.com
If the DNS is not able to resolve to these domains, it would not be possible for FortiGate to communicate with FortiGuard servers. If the current DNS is not working, you can try to change to another DNS to see if that works.
Also try to perform telnet forticare.fortinet.com 443
Please review the following article:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Getting-license-invalid-error-when/t...
-BR-
Hi Mr. Ndumaj,
I performed all the pings you suggested and also the telnet test and all of them was successful, I visited the article you mentioned and there is a test to show the default auth-cert, I executed the command and I got "self-sign" instead of "Fortinet_Factory". Could this be the problem ?
Hello Yassinonce,
Well the cert also might be the problem.
FGT is the client and Forticare is the web server, Forticare is presenting the server certificate then FGT should be able to validate that cert with his own certificate(root CA) if it not able to validate ssl handshake will fail and cant establish the ssl connection.
You can see more details about the SSL handshake on a PCAP.
-BR-
Hi,
What is the solution in this case ?
Hi,
Try to set Fortinet_Factory :
config sys global
set auth-cert Fortinet_Factory
next
end
-BR-
Hi again,
I changed the default auth-cert to Fortinet_Factory, but the problem still persists. I ran Wireshark and I noticed the TLS handshake failed in the last phase of it which means that the VM can't verify the fortiguard server certificate, but I still don't know why even if I changed the authe-cert.
hi,
Please can you also review this guide:
https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/441460/permanent-trial-mode-...
-BR-
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.